Platform engineering · Belgium
I am Alexander Kerckhofs, a platform engineer. Through Exalis I build and operate secure Kubernetes platforms on Azure, along with the geodata pipelines that depend on them.
Six years on one production platform. Client names stay private, but every number comes from the project records. References are available on request.
40min
to mitigate every production node without a reboot
Rolled out a mitigation for a kernel privilege-escalation flaw on the evening it was flagged. It was verified again after the next node-image upgrade.
+8GiB
additional memory per database pod, injected silently
Production stopped scheduling when the managed-Kubernetes provider quietly enabled an admission policy that padded every database sidecar. Within the morning I had traced the outage to that policy and switched it off. The vendor received an evidence pack.
115 to 14ms
CPU time per orthophoto tile
Rewrote the read path of a production tile service. Responses are now several times faster, with tiles a tenth of their former size. The output is pixel-identical.
2% to 92%
valid 3D building solids
Two open-source reconstruction engines were examined down to their solvers and geometry code before either was trusted with a delivery. The first rests on an integer program that stalls on complex buildings, with almost none of its output passing geometric validation. The second selects roof faces through a graph cut, yet its quality turned out to be decided earlier, in plane detection, which is where it was tuned against hand-labelled roofs. These findings come from controlled experiments on thousands of real buildings. The resulting pipeline publishes valid models for hundreds of statistical sectors.
The engineer who builds your platform is the one who operates and secures it. That same engineer understands the geodata workloads it carries.
Multi-tenant Kubernetes on Azure, where every change goes through GitOps. The platform comes with the services teams would otherwise run themselves, such as databases or single sign-on. Capacity is planned against cost from the start.
Vulnerability management that follows each finding from the inventory to the patch. Access to the platform is held to least privilege. Security events get a written assessment that holds up in an ISO 27001 audit.
Some failures survive the usual fixes. I follow them through logs, profiles or packet captures until the cause is proven. If the fault lies with a vendor, they receive evidence they cannot wave away.
Pipelines that turn LiDAR point clouds into reconstructed 3D buildings, published through web viewers that stay smooth at country scale. Current work applies Gaussian splatting to city blocks, using oblique aerial imagery with LiDAR as the geometric reference.
An opinion comes after the profile or the benchmark, never before. That is how the root cause gets fixed instead of the loudest symptom.
Every trade-off or open risk is put in writing, where an idealised diagram would hide it.
The documentation lives in your repository, from runbooks to decision records, so your team owns the system when I leave.
Exalis is a one-engineer consultancy. You work directly with the person who designs and builds the system.
I work in production environments under ISO 27001, with NIS2 in mind, where I am trusted with privileged access. On my main engagement I am the platform engineer, which includes a seat on the security team. My background runs from operating Kubernetes platforms to building LiDAR pipelines at municipal scale. When a decision needs weighing, you get a written evaluation: detailed enough for engineers, with a conclusion a board can act on.
Tell me what you are building. The answer comes in Dutch or English, from the engineer who would do the work. From there it can become a fixed-scope investigation, a written evaluation or a full project.
Not taking on long-term projects right now. Always happy to sit down and talk something through.